[PATCH] Fix segfault with restricted authorized_key files without forced command.

S $ sed -n '/ ssh-.*/{s///p; q}' ~/.ssh/authorized_keys no-port-forwarding S $ /usr/sbin/dropbear -r /tmp/dropbear.key -svEF -p 127.0.0.1: […] [6773] Jun 22 01:56:38 Port forwarding disabled. […] [6773] Jun 22 01:56:38 Port forwarding disabled. […] [6773]

[PATCH] Fix typo in dropbear(8)'s manpage.

--- dropbear.8 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dropbear.8 b/dropbear.8 index 42f8ddb..3e05b08 100644 --- a/dropbear.8 +++ b/dropbear.8 @@ -100,8 +100,8 @@ Print the version .TP Authorized Keys -~/.ssh/authorized_keys can be set up to allow remote

Re: Detached tarball signatures vs. clearsigned checksum files

On Mon, 29 Jun 2015 at 15:13:44 +0100, Andrea Bolandrina wrote: how do I remove myself from this mailing list? There is no link at the bottom (or anywhere else)... Yes, not in the body but in the headers: List-Unsubscribe: http://lists.ucc.gu.uwa.edu.au/mailman/listinfo/dropbear,

Re: Detached tarball signatures vs. clearsigned checksum files

Hi, On Mon, 29 Jun 2015 at 21:27:23 +0800, Matt Johnston wrote: New Debian packages would be great. I've signed releases/dropbear-2015.67.tar.bz2.sig for the latest one so far, I'll keep more for future releases. […] Making a new pgp key has been on my todo list so there is now a Dropbear

Re: Mercurial dotfiles (Was: Detached tarball signatures vs. clearsigned checksum files)

On Mon, 29 Jun 2015 at 22:06:20 +0800, Matt Johnston wrote: On Mon, Jun 29, 2015 at 03:51:54PM +0200, Guilhem Moulin wrote: That's great, thanks! While I'm at it, please also consider excluding mercurial dotfiles from the tarballs: Do they cause a problem? At least hg_archival.txt is kind

Detached tarball signatures vs. clearsigned checksum files

Hi Matt, I'm currently helping out packaging dropbear for Debian [0]. As mentioned on your webpage the drobpear package is currently rather outdated (even sid is lagging behind with 2014.65-1), and in order to reduce the delays between upstream and package releases I'd like to make the import of

[PATCH] Fix minor manpage formatting issues.

--- dbclient.1| 11 +-- dropbear.8| 9 - dropbearconvert.1 | 10 +- dropbearkey.1 | 7 ++- 4 files changed, 16 insertions(+), 21 deletions(-) diff --git a/dbclient.1 b/dbclient.1 index c33f955..259c786 100644 --- a/dbclient.1 +++ b/dbclient.1 @@

Re: [PATCH] Fix minor manpage formatting issues.

Hi, We've also got the two attached patches in the Debian package. Please consider applying them upstream. (Actually both dropbear(8) and dropbearconvert(1) mention the ‘-y’ flag for dropbearkey, but it's currently undocumented in the upstream manpage.) Cheers, -- Guilhem. From

Re: svr_getopts should either support bundling or fail if bundling is used

Hi Matt, On Wed, 21 Oct 2015 at 22:11:43 +0800, Matt Johnston wrote: > Thanks for pointing that out, I’ve made -sjk fail rather than be > dropped silently. Thanks. However on second thought, the downside of this solution is that it might render remote systems unreachable after upgrade (at least

[PATCH] Enable bundling in svr-runopts's svr_getopts.

On Wed, 28 Oct 2015 at 21:47:24 +0800, Matt Johnston wrote: > I've changed the code to just print a warning for the time being. I'm > intending for the next release to be soon with small bugfixes. Using getopt > would probably be good though would require checking availability for the > platforms

Re: svr_getopts should either support bundling or fail if bundling is used

On Thu, 22 Oct 2015 at 08:02:01 +0800, Matt Johnston wrote: > On Thu 22/10/2015, at 1:21 am, Guilhem Moulin <guil...@fripost.org> wrote: >> Thanks. However on second thought, the downside of this solution is >> that it might render remote systems unreachable af

[PATCH] Enable bundling for dbclient.

--- cli-runopts.c | 202 ++ 1 file changed, 92 insertions(+), 110 deletions(-) diff --git a/cli-runopts.c b/cli-runopts.c index 2b0cb7d..59ebb5a 100644 --- a/cli-runopts.c +++ b/cli-runopts.c @@ -105,25 +105,30 @@ static void printhelp() {

svr_getopts should either support bundling or fail if bundling is used

Hi, It's fine not to implement bundling in dropbear's option parsing function (svr-runopts.c's svr_getopts), but it should at least croak if argv[i][2] != '\0'. For instance dropbear -rdropbear.key -p127.0.0.1: -sjk should either fail, or be parsed as dropbear -r dropbear.key -p

/etc/motd is also printed on non-login shells if a TTY has been requested

Hi, As of 2015.68, dropbear(8) says “By default the file /etc/motd will be printed for any login shell (unless disabled at compile-time). This can also be disabled per-user by creating a file ~/.hushlogin .” But in fact /etc/motd is printed whenever a TTY has been requested, even

Re: [PATCH] Fix minor manpage formatting issues.

On Wed, 28 Oct 2015 at 21:44:34 +0800, Matt Johnston wrote: > Thanks, I've applied these. In case you just missed it: FYI the patch at the root of this thread has not been applied. -- Guilhem. signature.asc Description: PGP signature

Re: Cryptroot-unlock Timeout on askpass

Hi, On Tue, 09 Jul 2019 at 09:02:53 +, Luke Flinders wrote: > We have had the remote decrypting functioning for a while, however > following recent updates to Debian it has now stopped working. > […] > I have had a look through your mailing archive and can not see this > issue mentioned

Re: "Bad public key options"

On Wed, 17 Jun 2020 at 20:18:58 +0800, Matt Johnston wrote: >> On Tue 16/6/2020, at 9:58 am, Guilhem Moulin wrote: >>> - […] x11 forwarding are now disabled by default. >> >> I have no opinion about disabling this at compile-time, however the >> current implemen

Re: "Bad public key options" (Was: Dropbear 2020.79)

uilhem. From: Guilhem Moulin Date: Tue, 16 Jun 2020 00:32:28 +0200 Subject: Don't choke on disabled authorized_keys(5) options As of 2020.79 X11 forwarding is disabled at build time, which could lock out users with authorized_keys(5) files containing ‘no-X11-forwarding’ options. --

Patch: use a different $PATH for the root user

Hi Matt, Received the attached patch from Raphael Hertzog at https://bugs.debian.org/903403 . You wrote in the bug report that you'd apply the patch upstream but maybe that fell off-screen? Forwarding to the list for more visibility anyway. :-) Cheers, -- Guilhem. --- a/default_options.h +++

[PATCH] Support running test/test_aslr.py without venv

://salsa.debian.org/debian/dropbear/-/blob/debian/latest/debian/patches/support-running-test_aslr-without-venv.patch which I'm also attaching to this mail for convenience. Thanks, cheers -- Guilhem. From: Guilhem Moulin Date: Fri, 1 Apr 2022 23:27:50 +0200 Subject: Support running test_aslr without venv. Without

[PATCH] Fix build failure on hurd-i386.

GNU Hurd defines neither IOV_MAX nor UIO_MAXIOV. --- netio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/netio.c b/netio.c index 2ed9bb1..294c239 100644 --- a/netio.c +++ b/netio.c @@ -304,7 +304,7 @@ void packet_queue_to_iovec(const struct Queue *queue, struct iovec